Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Not true. SignInLogs are only interactive sign ins to Entra. Entra logs non interactive sign ins to AADNonInteractiveUserSignInLogs. However, I can't see "AccountObjectID" in the SignInLogs table. But it definitely exists in IdentityLogonEvents table (which I gather is the AD DS version of SignInLogs).
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
IdentityInfo SigninLogs. (because it primarily logs interactive sign-ins) Identitylogonevents logs every logon event including interactive signing for efficiency of the query, SigninLogs should be used.
Not true. SignInLogs are only interactive sign ins to Entra. Entra logs non interactive sign ins to AADNonInteractiveUserSignInLogs. However, I can't see "AccountObjectID" in the SignInLogs table. But it definitely exists in IdentityLogonEvents table (which I gather is the AD DS version of SignInLogs).
Could someone please explain why SinginLogs in incorrect?